Every summer the same scene repeats across Spain: receptions asking for a photocopy of the DNI, holiday flats demanding a photo of the passport by WhatsApp before handing over keys, check-in forms requesting the document scanned on both sides. And every summer brings more complaints. Spain’s consumer watchdog FACUA issued its reminder on 10 July: lodgings may not demand a photo or scan of your ID at check-in. They may only ask to see it.
The confusion has an honest origin: Royal Decree 933/2021 obliges every Spanish lodging to register and report each traveller’s data, and a photocopy looks like the fastest way to avoid typos. But the Spanish data protection agency (AEPD) has said clearly that this route is illegal, and it has already fined for it. The good news: complying with both rules at once is perfectly possible.
What Spanish law requires (and what it doesn’t)
The decree demands three things of your rental:
- Collect each traveller’s data listed in its Annex I: identity, document type and number, date of birth, and the stay and payment details.
- Keep a digital register of that data (article 5.1) for three years after the stay ends (article 5.3).
- Report it to SES.HOSPEDAJES within 24 hours (article 6).
What appears in no article: any obligation to keep a copy of the document. The decree asks for data, not images. That nuance is the whole story.
What the AEPD says, verbatim
The AEPD published a dedicated note on lodgings on 17 June 2025, answering exactly this question. Its conclusion:
“Requesting a copy of the National Identity Document or Passport violates the principle of data minimisation established in article 5.1.c) of the GDPR and constitutes excessive data processing.”
The reasoning is twofold. First, a full ID card contains more data than the rule obliges you to collect: the photograph, expiry date, card access number, parents’ names. Second, accumulating document copies creates an unnecessary identity-theft risk if anyone reaches that archive. The note adds a point that demolishes the practical excuse: a copy does not even verify the sender’s identity, and the ID alone does not contain all Annex I fields, so it saves you no form.
The fines are already real
In 2021 the AEPD fined a Balearic hotel 30,000 euros (resolution PS/00078/2021) for scanning guests’ passports at check-in and keeping the photo. The complaint came from a Dutch guest. And in 2023, as reported by Confilegal, a manager of Airbnb-listed flats received a 75,000-euro penalty for an online check-in that demanded photos of both sides of the ID plus a selfie from every guest.
The asymmetry is uncomfortable but real: Spain’s Interior Ministry fines you for not filing the guest report, and the AEPD fines you for collecting too much. Compliance sits exactly in the middle: every Annex I field, and not one more.
How to run check-in correctly at a Spanish rental
The AEPD’s own note describes the valid routes.
In person. The guest fills in (or confirms with you) a form with the Annex I data, and you visually check that it matches the document they show you. Look, compare, hand it back.
Remotely (online check-in). The AEPD accepts several formulas: digital certificates, cross-checking against the payment details, or security codes sent to the traveller’s phone or email as an authentication factor. What is not on the list: “send me a photo of your passport on WhatsApp”.
With minors. No copy question even arises: children under 14 do not sign, and their data is provided by the responsible adult. Ages and responsibilities are covered in our guide to minors in Spanish guest registration.
What if the guest consents? Tempting, but a consent conditioned on receiving the keys is hardly free (the classic article 7.4 GDPR problem), and the AEPD’s core objection is minimisation: you are collecting more data than needed, consent or not. None of the routes the agency accepts involves keeping a copy of the document.
The quick reference table
| Practice | Compliant? |
|---|---|
| Looking at the ID and checking the form data against it | Yes |
| Online check-in form with the Annex I fields | Yes |
| Verification by SMS/email code or payment data | Yes |
| Photocopying or scanning the ID “for the records” | No |
| Requesting an ID photo by WhatsApp or email before arrival | No |
| Demanding a selfie with the document | No |
RegistroViajero’s digital check-in is built on this exact logic: each guest fills in their own data in their own language (9 available), the system validates the Annex I fields, and the report goes to SES.HOSPEDAJES on time. No document photos, no photocopy archive to guard, no manual typing into the portal. You can see how it works if you want your Spanish rental running this way this summer.
Frequently asked questions
Can I ask a guest in Spain to show me their ID? Yes, and you must: viewing the document is how you verify the data they gave you. What you cannot do is keep a copy, photo or scan.
What if the guest sends me an ID photo on their own initiative? Don’t keep it. The legal problem is not who initiates the sending but the processing: storing document copies is excessive processing per the AEPD.
How do I meet the three-year record duty then? By keeping the data, not the documents. Article 5 of Royal Decree 933/2021 requires a digital register with the Annex data for three years after each stay.
What can happen if I keep photocopying? A complaint to the AEPD and a GDPR fine. Precedents in Spanish lodgings stand at 30,000 and 75,000 euros for scanning or demanding document photos.
Does this change the data I send to SES.HOSPEDAJES? No. The Annex I fields and the 24-hour deadline stay the same. What changes is how you collect, not what you report.
Sources and disclaimer
Sources: AEPD note on ID copies in lodgings, 17 June 2025 and its press note; Royal Decree 933/2021 (BOE); AEPD resolution PS/00078/2021; FACUA via Que.es, 10 July 2026; Confilegal, 17 May 2023.
This article is informational and is not legal advice.
